Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-90711: proxy-addr can let attackers fake client IP
CVE-2026-90711 · published today
Summary
The proxy-addr component used in Node.js applications can be tricked into accepting false client address information, which could let an attacker hide their real source or bypass access controls. This affects installations of proxy-addr from npm, Debian, Canonical and related packages. Upgrade to the newest version that includes the fix from Root or the package maintainer.
What to do
- Update proxy-addr to version 2.0.8.
- Update proxy-addr to version 2.0.7-aikido.2.
- Update rootio @rootio/proxy-addr to version 2.0.7-root.io.2.
- Update proxy-addr proxy-addr to version 2.0.8 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | proxy-addr | proxy-addr | < 2.0.8 |
| Debian:12 | debian | node-proxy-addr | All versions |
| Ubuntu:16.04:LTS | canonical | node-proxy-addr | All versions |
| npm | – | proxy-addr |
>= 1.1.0, < 2.0.8 Fix: upgrade to 2.0.8
|
| Root:npm | – | proxy-addr |
< 2.0.7-aikido.2 Fix: upgrade to 2.0.7-aikido.2
|
| Root:npm | rootio | @rootio/proxy-addr |
< 2.0.7-root.io.2 Fix: upgrade to 2.0.7-root.io.2
|
Original advisory text
CVE-2026-90711 in proxy-addr - Patched by Root
Root has patched CVE-2026-90711 in the proxy-addr package for Root:npm. Multiple fixed versions available.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90711... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-90711
- https://ubuntu.com/security/CVE-2026-90711 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-90711 Third Party Advisory
- https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h
- https://cna.openjsf.org/security-advisories.html
- https://security-tracker.debian.org/tracker/CVE-2026-90711 Vendor Advisory
- https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec1...
- https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8
- https://github.com/advisories/GHSA-jqcg-44mw-7w3h
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-290Authentication Bypass by Spoofing
CWE-348Use of Less Trusted Source
CWE-697Incorrect Comparison
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen15 Sep 2026
Sources
CVE-2026-90711 · NVD
CVE-2026-90711 · MITRE
DEBIAN-CVE-2026-90711 · OSV
CVE-2026-90711 · OSV
GHSA-jqcg-44mw-7w3h · GHSA
UBUNTU-CVE-2026-90711 · OSV
Track software like this
Free during beta